git-ecosystem/git-credential-manager · error · InvalidOperationException

Invalid response from GitHub OIDC token endpoint: 'value'…

Error message

Invalid response from GitHub OIDC token endpoint: 'value' property not found.

What it means

GCM requested a short-lived OIDC token from the GitHub Actions token endpoint (ACTIONS_ID_TOKEN_REQUEST_URL) and the JSON response did not contain a 'value' property, so the token cannot be extracted. This means GitHub did not return the expected token envelope.

Solutions

  1. Add 'permissions: id-token: write' to the workflow/job so GitHub issues OIDC tokens
  2. Verify ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars are present and correct in the job
  3. Check the raw response (logged via GCM trace: 'OIDC token response:') to see what the endpoint actually returned
  4. Confirm audience parameter matches what the federation trust expects

Example fix

# before (.github/workflows/ci.yml)
jobs:
  build:
    steps: [ - uses: actions/checkout@v4 ]
# after
jobs:
  build:
    permissions:
      id-token: write
      contents: read
    steps: [ - uses: actions/checkout@v4 ]
Defensive patterns

Strategy: try-catch

Validate before calling

// in GitHub Actions, fail fast when OIDC is unavailable
if (!Environment.TryGetEnvironmentVariable("ACTIONS_ID_TOKEN_REQUEST_URL", out _))
    throw new InvalidOperationException("Workflow lacks id-token permission or ACTIONS_ID_TOKEN_REQUEST_URL.");

Type guard

bool LooksLikeOidcTokenResponse(string json) {
    using var doc = JsonDocument.Parse(json);
    return doc.RootElement.ValueKind == JsonValueKind.Object && doc.RootElement.TryGetProperty("value", out var v) && v.ValueKind == JsonValueKind.String;
}

Try / catch

try { /* entra auth */ }
catch (InvalidOperationException ex) when (ex.Message.Contains("GitHub OIDC token endpoint")) { /* check workflow permissions/id-token config and retry */ }

Prevention

When it happens

Trigger: GetGitHubOidcToken parses the endpoint's response with JsonDocument.Parse and TryGetProperty("value", ...) fails — e.g. the request URL is wrong, the response is an error object, or permissions/id-token settings are missing so GitHub returns a different shape.

Common situations: GitHub Actions workflow lacking 'permissions: id-token: write'; invalid ACTIONS_ID_TOKEN_REQUEST_URL or token; GitHub API returning an error/HTML page instead of the token JSON; proxy injecting an error body.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/6fedc21447b85c70. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs:145

        Context.Trace.WriteLine($"Requesting GitHub OIDC token from '{request.RequestUri}'...");
        Context.Trace.WriteLineSecrets("OIDC request token: {0}", new[] { requestToken });
        using HttpResponseMessage response = await http.SendAsync(request);
        if (!response.IsSuccessStatusCode)
        {
            string error = await response.Content.ReadAsStringAsync();
            Context.Trace.WriteLine(
                $"Failed to acquire GitHub OIDC token [{response.StatusCode:D} {response.StatusCode}]: {error}");
            response.EnsureSuccessStatusCode();
        }

        string json = await response.Content.ReadAsStringAsync();

        try
        {
            using JsonDocument jsonDoc = JsonDocument.Parse(json);
            if (!jsonDoc.RootElement.TryGetProperty("value", out JsonElement tokenElement))
            {
                throw new InvalidOperationException(
                    "Invalid response from GitHub OIDC token endpoint: 'value' property not found.");
            }

            return tokenElement.GetString() ??
                   throw new InvalidOperationException(
                       "Invalid response from GitHub OIDC token endpoint: 'value' property is null.");
        }
        catch (Exception ex)
        {
            Context.Trace.WriteException(ex);
            Context.Trace.WriteLine($"OIDC token response: {json}");
            throw;
        }
    }
}

View on GitHub (pinned to e8ce762cd0)